Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2024-12-16_b3a70042309bc77235a552db45c4139d_floxif_mafia
-
Size
2.4MB
-
Sample
241216-av97eavkh1
-
MD5
b3a70042309bc77235a552db45c4139d
-
SHA1
893aec420ab087e09e6e638d7453250b458c1e72
-
SHA256
2d3e3e39cbb5548faf848aca82dbbae4e2033c3b955740d96ab255b5667df2a9
-
SHA512
88aed508a0b75035f54971822c4966f3f0076b216469fbfa2ff95a44c273065767c5e6be5e39183cb17178ad4330440d847b66cdce4f293cc0eea0413484ffb0
-
SSDEEP
49152:2QuE7AkqIxGrGYyZa/tgrYJUGfZC3wA6EylfwEaFW31q9:OE7AfrlyutLxC3sEwwM3U9
Static task
static1
Behavioral task
behavioral1
Sample
2024-12-16_b3a70042309bc77235a552db45c4139d_floxif_mafia.exe
Resource
win7-20240903-en
Malware Config
Targets
-
-
Target
2024-12-16_b3a70042309bc77235a552db45c4139d_floxif_mafia
-
Size
2.4MB
-
MD5
b3a70042309bc77235a552db45c4139d
-
SHA1
893aec420ab087e09e6e638d7453250b458c1e72
-
SHA256
2d3e3e39cbb5548faf848aca82dbbae4e2033c3b955740d96ab255b5667df2a9
-
SHA512
88aed508a0b75035f54971822c4966f3f0076b216469fbfa2ff95a44c273065767c5e6be5e39183cb17178ad4330440d847b66cdce4f293cc0eea0413484ffb0
-
SSDEEP
49152:2QuE7AkqIxGrGYyZa/tgrYJUGfZC3wA6EylfwEaFW31q9:OE7AfrlyutLxC3sEwwM3U9
-
Floxif family
-
Detects Floxif payload
-
Event Triggered Execution: AppInit DLLs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
1AppInit DLLs
1Pre-OS Boot
1Bootkit
1